65ad2478227e741dca264fefbf2a4f463743cc4cf705c7237526c2e3c079a3b4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe
Size

120KB
MD5

35a6995a16fbe67481d1f4009097bc96
SHA1

3bed5242a1d55727237c9961b5ed4051d8574807
SHA256

65ad2478227e741dca264fefbf2a4f463743cc4cf705c7237526c2e3c079a3b4
SHA512

995ba407f4a47d291ccde90a03906e6b76cb3b16f93fb573bbb947bd908164f0f1376c117b5d410c85fff13e04f18a8d2ffa04e8c2f2b7e862b782197ace927c
SSDEEP

3072:DWz+jh/MvQk6MaV38shyoCB3equmwLwL:SzQ6Qk6foZufLi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
9996	cleansweep.exe

Loads dropped DLL 2 IoCs

pid	Process
2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe
2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe
2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe
9996	cleansweep.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe
Token: SeDebugPrivilege	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe
Token: SeDebugPrivilege	9996	cleansweep.exe
Token: SeDebugPrivilege	9996	cleansweep.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 1176	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	21
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 392	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	4
PID 2404 wrote to memory of 432	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	5
PID 2404 wrote to memory of 432	2404	35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe	5

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:392
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:588
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1560
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1016
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:804
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1152
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:276
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:496
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1076
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1100
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:268
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2544
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2576
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\35a6995a16fbe67481d1f4009097bc96_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\cleansweep.exe\cleansweep.exe
    "C:\cleansweep.exe\cleansweep.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:9996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\cleansweep.exe\config.bin

Filesize
1KB

MD5
cebe8b9a83d6b8907b1dd52ef798f046

SHA1
af396bc6fe3e8a38e24c0a0b1b3ecef05b48d6b0

SHA256
9b75de651bf631272e8193ced7dde7c5b40094797a6b02fec952d32185216ba9

SHA512
0787900cd6c044d69de6ddcc4308f6f887a051bb1b0aa8ec68141d4317435e1e8370d2845e51459040dcb7dabf6aea204c33cb5502312f05f81126de486407c5

Download Submit
\cleansweep.exe\cleansweep.exe

Filesize
120KB

MD5
35a6995a16fbe67481d1f4009097bc96

SHA1
3bed5242a1d55727237c9961b5ed4051d8574807

SHA256
65ad2478227e741dca264fefbf2a4f463743cc4cf705c7237526c2e3c079a3b4

SHA512
995ba407f4a47d291ccde90a03906e6b76cb3b16f93fb573bbb947bd908164f0f1376c117b5d410c85fff13e04f18a8d2ffa04e8c2f2b7e862b782197ace927c

Download Submit
memory/1176-36-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-12-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-42-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-9-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-45-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-15-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-18-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-24-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-27-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-30-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-21-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-48-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-66-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-39-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-3-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-6-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-33-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-51-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-54-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-57-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-60-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/1176-63-0x000000000EA00000-0x000000000EA1F000-memory.dmp

Filesize
124KB

Download
memory/2404-0-0x00000000003A0000-0x00000000003C1000-memory.dmp

Filesize
132KB

Download
memory/2404-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2404-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2404-2249-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2404-2248-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2404-2247-0x00000000003A0000-0x00000000003C1000-memory.dmp

Filesize
132KB

Download
memory/9996-60624-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download